Subject: [stir] Spencer Dawkins' Yes on draft-ietf-stir-passport-shaken-05: (with COMMENT)

From: Spencer Dawkins <[email-masked]>
Date: Tue, 20 Nov 2018 18:47:38 -0800

Spencer Dawkins has entered the following ballot position for
draft-ietf-stir-passport-shaken-05: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-stir-passport-shaken/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I echo Ben's "Yes assuming the Discusses can be resolved". It's about time we
provided this capability!

I did have a couple of comments you might want to consider, along with anything
else that pops up during IESG Evaluation.

"SHAKEN" isn't spelled out in either the title or Abstract - that would
probably help almost all the readers of this document ...

I did find it odd that

  This indicator allows for both identifying the service provider that
   is vouching for the call as well as clearly indicating what
   information the service provider is attesting to.  The 'attest' claim
   can be one of the following three values: 'A', 'B', or 'C' as defined
   in [ATIS-1000074].

used "A", "B", and "C", instead of something like "F"(ull), "P"(artial), and
"G"(ateway), because if you discover a need for a fourth value, it's not clear
whether anyone would be assuming "A" < "B" < "C" ordering in their code, that
would break if the fourth value was naturally between "A" and "B".  If you're
sure no one but Spencer would be so dumb, that's a fine response ...

---

From: Ben Campbell <[email-masked]>
Date: Tue, 20 Nov 2018 21:42:38 -0600

> On Nov 20, 2018, at 8:47 PM, Spencer Dawkins <[email-masked]> wrote:
> 

Hi Spencer,

I considered making that same comment, but that bit of oddness may already be written in stone, since it’s the terminology used in the ATIS SHAKEN document. IIUC that already published in its final form.

Ben.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 21 Nov 2018 07:27:04 -0600

Hi, Ben,

On Tue, Nov 20, 2018 at 9:42 PM Ben Campbell <[email-masked]> wrote:

> > Please refer to
> https://www.ietf.org/iesg/statement/discuss-criteria.html
> I considered making that same comment, but that bit of oddness may already
> be written in stone, since it’s the terminology used in the ATIS SHAKEN
> document. IIUC that already published in its final form.
>

Yeah. I know that ATIS doesn't engrave their specifications on stone, so
that could change if it needed to, but this probably isn't the oddest thing
in a draft that I've balloted Yes on, so ...

"Do the right thing."

Spencer

---

From: Chris Wendt <[email-masked]>
Date: Mon, 26 Nov 2018 11:32:06 -0500

Hi Spencer,

I definitely wouldn’t say it’s a dumb comment, but the reasons behind the different levels of attestations is due to some of the realities of the current telephone network.  Going forward, we do not want to make more levels of attestation, rather we want all calls to essentially be “A” level full attestation, which is essentially pure STIR where the party signing the call does have the ownership of the telephone number and has control of the credentials to sign the call.  In the telephone network there is many cases where the party that owns the telephone number doesn’t have any relationship with the party that either places the call or originates the call on to the telephone network. (think a call center that uses the enterprise phone number as the outgoing calling identity for a customer service agent, or a snow delay robocall that uses the school district number) 

So bottomline, the number of attestation levels should not increase, but rather B and C should hopefully become less common as time goes on and SHAKEN/STIR is more widely deployed into these enterprise and call center environments.

-Chris

> On Nov 20, 2018, at 9:47 PM, Spencer Dawkins <[email-masked]> wrote:
>

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 28 Nov 2018 22:45:29 -0600

Hi, Chris,
On Mon, Nov 26, 2018 at 10:32 AM Chris Wendt <[email-masked]>
wrote:

> Hi Spencer,
>
> I definitely wouldn’t say it’s a dumb comment, but the reasons behind the
> different levels of attestations is due to some of the realities of the
> current telephone network.  Going forward, we do not want to make more
> levels of attestation, rather we want all calls to essentially be “A” level
> full attestation, which is essentially pure STIR where the party signing
> the call does have the ownership of the telephone number and has control of
> the credentials to sign the call.  In the telephone network there is many
> cases where the party that owns the telephone number doesn’t have any
> relationship with the party that either places the call or originates the
> call on to the telephone network. (think a call center that uses the
> enterprise phone number as the outgoing calling identity for a customer
> service agent, or a snow delay robocall that uses the school district
> number)
>
> So bottomline, the number of attestation levels should not increase, but
> rather B and C should hopefully become less common as time goes on and
> SHAKEN/STIR is more widely deployed into these enterprise and call center
> environments.
>

That's a perfectly lovely theory. Thanks for helping me understand the
thinking behind it.

Spencer